Malware

BleepingComputer reports that the MacSync information-stealing malware has been distributed through a code-signed and notarized Swift application, removing the necessity for direct terminal interaction and representing a departure from ClicFix or drag-to-terminal tactics previously used to spread the macOS infostealer.

Attacks involving the Brickstorm malware were noted by the Cybersecurity and Infrastructure Security Agency to continue threatening U.S. infrastructure, Cybersecurity Dive reports.

The attack impacted 10 of the country's 11 regional water basin administrations, including Oradea, Cluj, Iași, Siret, and Buzău.

The "lotusbail" package, downloaded over 56,000 times since May 2025, operates by wrapping the WebSocket client used for WhatsApp API interactions.

Attacks started in a malicious npm package hosted on GitHub or GitLab, according to Darktrace.

Amadey used a modified base64 algorithm to obfuscate strings to target browser credentials and cryptocurrency transactions.

The Wonderland malware, formerly known as WretchedCat, facilitates real-time command execution and SMS theft, masquerading as Google Play or common file types.